General

  • Target
    QUOTATION.exe
  • Size 298KB
  • Sample201109-5w5sd367xe
  • SHA256 ba9fbfd1eecd1879588201af8b4498bcef57e8950286170dbb0c7c5b7ded6a17
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • formbook

C2
  • http://www.nyoxibwer.com/20w/

Decoy
  • cofounder.technology

  • mrbajaf.com

  • xn--w9s874cfjq5fk.com

  • haliciogluhali.net

  • vanessadunfordhere.com

  • lookguy.win

  • 91javac.com

  • goldennd.com

  • nwatheeliteteam.net

  • tumpukganda.com

  • clarservicios.com

  • koghana.com

  • workingwithroland.com

  • yellowsocialbox.com

  • under-dawg.com

  • sdtjtzyz.com

  • banditaerialproductions.com

  • newssmog.com

  • tefnmp.men

  • rebelialabel.com

Targets

    • Target
      QUOTATION.exe
    • Size 298KB
    • SHA256 ba9fbfd1eecd1879588201af8b4498bcef57e8950286170dbb0c7c5b7ded6a17
    • MD5 SHA1 SHA512
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks